CVE-2026-110769

holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's...

EUVD-2026-101569

holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's...

CVE-2026-110769

The holaOS software (through version 2026.822.1 ) is vulnerable to a missing authorization flaw in its channel-gateway connectors . The root cause is that the #isAllowed check incorrectly accepts all senders when the default allowFrom list is empty. This allows any user on a messaging platform—su...